This removes a few cases from escapeAction and clarifies the
responsibilities of urlFilter which no longer does any
escaping or normalization.  It is now solely a filter.

R=nigeltao
CC=golang-dev
https://golang.org/cl/5162043